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Introduction 


This is the first consolidated annual report of the 
President of the Treasury Board on the administra- 
tion of the Access to Information Act and the Privacy 
Act (ATIP) within the Government of Canada. 


It summarizes the experiences of all federal institu- 
tions under both Acts, with an emphasis on events 
occurring between April 1, 1987, and March 31, 
1988. 


This document results from a recommendation in 
the March 31, 1987, report of the Standing Commit- 
tee on Justice and Solicitor General Open and Shut: 
Enhancing the Right to Know and the Right to Pri- 
vacy. The committee, in its review of the legislation, 
recommended that “...the Treasury Board... pre- 
pare Consolidated Annual Reports on the admini- 
stration of the legislation, based on Annual Reports 
received from government institutions”. In its re- 
sponse to the report, entitled Access and Privacy: 
The Steps Ahead, the government agreed to do so. 


Since the 1983 proclamation of both Acts, individual 
institutions have been required to submit annual 
reports to Parliament. This report is a consolidated 
overview of the operation of both Acts across gov- 
ernment and a summary of major administrative 
initiatives related to the legislation. Charts and 
tables complete this report. 


The Role of 

The President 

and Secretariat 

of the Treasury Board 


The President of the Treasury Board is the “desig- 
nated Minister” for the overall administration of the 
Access to Information Act and the Privacy Act. 


The designated Minister co-ordinates the implemen- 
tation and administration of the legislation across 
the government, including the regular publishing of 
descriptions of the records held by government 
institutions. 


The Information Management Practices Group in 
the Administrative Policy Branch of the Treasury 
Board Secretariat supports the President of the 
Treasury Board in carrying out these duties. 


The material for this report was obtained through 
the various co-ordinating functions of the Treasury 
Board Secretariat, the statistical reports submitted 
to the Secretariat and the annual reports prepared 
by institutions for Parliament. 


Accomplishments 


The major Treasury Board Secretariat activity dur- 
ing the review period centered on improving the 
administration of the two Acts, keeping in mind the 
various recommendations in the Standing Commit- 
tee’s report which was tabled just prior to the period 
covered by this report. Many of the initiatives dis- 
cussed here were first mentioned in the action plan 
accompanying the government’s response to the 
Committee’s report on October 15, 1987. 


Privacy Initiatives Since its response to the parlia- 
mentary committee the government took action to 
better protect the privacy of Canadians. It delivered 
two major policies; one on controls on data matching 
and one on collection and use of the Social Insur- 
ance Number (SIN). The government also reiter- 
ated its support for effective privacy protection for 
its employees and developed an Employee Privacy 
Code. 


Data Matching Policy Significant advances across 
society in computer technology and the rapid in- 
crease in the number of computerized data banks 
containing personal information raise questions 
about their threat to personal privacy. Essentially, 
data matching or linkage involves comparing per- 
sonal data from a variety of data banks to identify 
individuals common to those data banks. This infor- 
mation may then be used in decision-making related 
to those individuals. For example, some forms of 
social assistance may be available to an individual 
only if the person is not receiving another form of 
assistance administered by another department or 
level of government. Comparisons may reveal the 
identity of individuals attempting to receive both 
forms of assistance. When used responsibly, data 
matching is a valuable tool for modern public ad- 
ministration, but special administrative policies are 
required to ensure that the legal requirements and 
protection of personal information also apply to com- 
puterized operations. 


The new data matching policy, issued by the govern- 
ment this year, balances the need to benefit from the 
capabilities of modern technology with the need for 
fair information practices to ensure that personal 


privacy is protected. The new policy requires gov- 
ernment institutions to: 


+ assess the feasibility of a proposed match by 
ensuring that it complies with the provisions of 
the Privacy Act, and analyse the potential impact 
on the privacy of individuals and the costs and 
benefits of the data matching program; 

e notify the Privacy Commissioner of a new 
matching program 60 days before it is to begin; 

¢ account publicly in the Personal Information 
Index for all matching activities; and 

e subject information generated by a matching 
program to independent verification before 
using it for an administrative purpose. 


The policy is currently being implemented in institu- 
tions. In the first phase, they identify all matching 
activities involving personal information, eliminate 
those matches that do not meet the requirements of 
the Privacy Act and account publicly for all remain- 
ing matching activities in the Personal Information 
Index. 


Social Insurance Number Last year the Presi- 
dent of the Treasury Board announced that use of 
the Social Insurance Number (SIN) in federal insti- 
tutions would be limited to a short list of uses which 
either had already been approved by Parliament in 
the form of existing statutes or regulations, or which 
fall within the original intent of Parliament. These 
uses include taxation, pensions or social programs 
where the benefits derived clearly justify the prac- 
tice. Other uses of the SIN by federal institutions 
will be phased out over five years at an estimated 
cost of $16,000,000. Use of the SIN, for example, 
will be phased out on application forms for citizen- 
ship, on credit checks required for federal pro- 
grams, and as a principal federal employee identi- 
fier. The authorized uses of the SIN are shown in 
Appendix A. 


The new policy establishes special requirements for 


the collection and use of the SIN by government 
institutions. Briefly, these are as follows: 


e when an individual refuses to disclose her/his 
SIN, government institutions cannot withhold 
rights, benefits or privileges or impose penalties 
on that individual uzless the SIN is required by 
Acts, regulations or authorized programs, or as 
otherwise authorized by Parliament (see Appen- 
dix A); 

e when collecting the SIN, government institu- 
tions must inform the individual of the purpose 
for which the number is being collected; the 
authority under which the number is required; 
and whether any right, benefit or privilege can 
be withheld or penalty imposed if the number is 
not disclosed; 

e when the SIN is used in any personal informa- 
tion banks, government institutions must so 
indicate in the Personal Information Index and 
must cite the authority under which the number 
is collected as well as the purposes for which it 
is used. 


Employee Privacy Code To meet the goal of ef- 
fective privacy protection for federal employees, the 
essential elements of the Privacy Act were consoli- 
dated in an Employee Privacy Code. This is a prom- 
ise of privacy protection similar to that being 
adopted by many governments and the private sec- 
tor. The Code will be made available to federal pub- 
lic servants so that they can better understand their 
rights under the Privacy Act. It will also help Public 
Service managers with the administration of the Act. 
The Code is attached as Appendix B. 


Extension of Rights of Access Under the Acts 
On April 13, 1989, the government extended the 
right of access under the Privacy Act to all individu- 
als present in Canada, and also extended the right of 
access under the Access to Information Act to all 
individuals and corporations present in Canada. 
Extension of this right to unincorporated entities 
must await amendments to the Access to Information 
Act. Previously, Access rights under both Acts were 
available only to Canadian citizens or permanent 
residents. Special rights had been extended under 
the Privacy Act to foreign inmates in Canadian penal 
institutions. 


Support for ATIP Co-ordinators A study, “Ac- 
cess to Information and Privacy Co-ordinators: 
Their Status and Role”, was completed and its re- 
sults published and widely distributed to institutions 
and the public. The purpose of this study was to 
assist institutions in administering the organiza- 
tional aspects of the Access to Information Act and 
the Privacy Act, to review the responsibilities as- 
signed to Co-ordinators, and to ensure that adequate 
resources will be available to carry out these respon- 
sibilities. 


An intensive, in-depth training program on the Ac- 
cess to Information and Privacy Acts was designed for 
ATIP personnel and other public servants who re- 
quire knowledge of this legislation. Courses began 
last year and 17 are scheduled for the 1989-90 fiscal 
year. Privacy Act administration and Access to Infor- 
mation Act administration are given as separate 
courses. They provide an excellent means through 
which federal public servants can become aware of 
the requirements of the legislation. 


Also, a series of training workshops dealing with 
specific issues and problems of special interest to 
ATIP professional personnel has been established; 
so far, two workshops have been held. The training 
and development initiatives were reinforced by im- 
plementation reports and circulars issued to the 
ATIP community on a variety of subjects regarding 
the administration of both Acts. A brochure and a 
poster on ATIP training were prepared and issued 
and the PSC has included the ATIP courses in its 
annual Schedule of Courses. Also, an inventory of 
senior ATIP staff was established by the Public Serv- 
ice Commission to help staffing and career develop- 
ment. 


Crown Corporations The essential preparatory 
work has been completed to include Crown Corpo- 
rations and other agencies under the Privacy Act. 


Communications Policy The Standing Committee 
that reviewed the access and privacy legislation 
expressed concern that informal means of providing 
information were being neglected in favour of the 


legal processes of the two Acts. Some of those con- 
cerns were addressed as part of the government’s 
general review of communications management in 
government. In June 1988 the government intro- 
duced a new policy for the effective management of 
government communications. 


The prime goal of the policy is to provide informa- 
tion to the public about its policies, programs and 
services that is accurate, complete, objective, timely, 
relevant and understandable. Institutions must also 
take into account public concerns and views when 
establishing priorities, developing policies and im- 
plementing programs; and ensure that government 
is visible, accessible and accountable to the public 
that it serves. 


The Access to Information Act provides the legal 
framework for openness in government by giving 
Canadians the right of access, subject to limited and 
specific exemptions, to government information. 
The Act also makes it clear that it only complements 
and does not replace existing procedures for access 
to government information and should not limit in 
any way access to the type of government informa- 
tion that is normally available to the general public. 
The government will strengthen and improve access 
to channels of information other than through the 
Access legislation. 


The government is already beginning to exploit the 
new information technologies to preserve and en- 
hance public access to government information. 
The rapid growth of computer networking, desktop 
publishing, optical disk technology and other com- 
puter-driven systems for information dissemination, 
will gradually displace traditional methodologies. A 
new information dissemination universe will be re- 
quired which balances the roles of individual institu- 
tions and government-wide mechanisms and may 
involve arrangements with the private sector. The 
government will be moving in this direction over the 
next few years, as well as determining how to meet 
the considerable costs involved. 


Information Management Good information 
management is, first and foremost, essential to 
sound and efficient delivery of government pro- 
grams and activities. An important by-product is 
more effective identification of government informa- 
tion holdings that are of interest to the public and, 
where appropriate, ready access to such informa- 
tion. 


Information management encompasses a full range 
of concerns from information creation or collection, 
through its use and dissemination, to its disposal or 
archival retention. It includes ensuring the security 
of the information and the maintenance of an infor- 
mation holdings inventory both for management 
purposes and for accountability to the public. 


The Access to Information Act and the Privacy Act 
have precipitated an examination of the whole proc- 
ess by which the government is accountable, not 
just for the decisions that it takes, but for the infor- 
mation upon which these decisions are based, and 
for the manner in which the information is de- 
scribed and made accessible to the public. 


The Standing Committee that reviewed the two Acts 
has provided a public focus on the wider issue of 
“open government,” as well as on the adequacy of 
the government’s efforts to account for, describe, 
retrieve and disseminate information in response to 
public demands. With the evolution of new technol- 
ogy for data matching, the committee has also taken 
note of the need for special controls to protect the 
privacy of individuals. 


In the longer term, there is a need to ensure that all 
information-based resources within the government 
are consistently managed within a comprehensive 
policy framework. The overall objective of such a 
policy would be to ensure that policies in the infor- 
mation management sector such as access to infor- 
mation and privacy, security, information collection, 
dissemination, use, retention and disposal, and rec- 
ords and data management are consistent with one 
another and with corporate goals and objectives. 


Management of Government Information 
Holdings Policy The federal government is the 
largest producer, user and disseminator of informa- 
tion in Canada. Because of the size and importance 
of its information activities, it is government policy 
to ensure the cost-effective and co-ordinated man- 
agement of its information holdings by: 


e disseminating its information products and serv- 
ices in a way that ensures that members of the 
public whom it has an obligation to reach have a 
reasonable ability to acquire the information; 

e managing all information holdings as a corpo- 
rate resource to support effective decision-mak- 
ing, meet operational requirements and protect 
the legal, financial and other government and 
public interests; 

e making the widest possible use of information 
within the government by ensuring that it is 
organized to facilitate access by those who re- 
quire it, subject to legal and policy constraints; 

e reducing response burden on the public by 
eliminating unnecessary information collection; 
and 

e identifying and conserving information holdings 
that serve to reconstruct the evolution of policy 
and program decisions, or have historical or 
archival importance, and ensuring that such 
information is organized in a manner readily 
available for the study of decision-making in 
government and other educational purposes 
which explain the historical role of the federal 
government in Canadian society. 


This policy provides a comprehensive administrative 
overview that takes into account all information 
holdings in government institutions, regardless of 
the media in which the information is contained. Its 
implementation will support those technological 
opportunities that may open up many new and po- 
tentially cost-effective ways to disseminate federal 
information. 


Improved Responses to Access to Information 
Requests The parliamentary committee, men- 
tioned earlier, recommended that “the Treasury 
Board and the Department of Justice become more 
active in central co-ordination and policy leadership 
on issues with government-wide implications for 
Access and Privacy legislation”. In addition, the 
Information Commissioner identified time-delay 
problems in responding to access requests. 


Accordingly, the government analysed the problems 
and continues to address them through training and 
workshops for Access co-ordinators. It is instituting 
new response mechanisms including automated 
systems to enable institutions to identify similar 
requests received by other institutions. This will 
help ensure consistent responses to Access re- 
quests. It has also made it easier for departments to 
seek assistance where requests involve major legal 
or policy issues. 


ATIP Publications As required by the Acts, 
Treasury Board has been publishing annually since 
1983 the Access Register, the Personal Information 
Index and two issues of the Bulletin. The publica- 
tions are distributed to some 7,500 recipients across 
Canada, including post offices, libraries, constitu- 
ency offices and government offices. Printing, distri- 
bution and associated costs are about $900,000 a 
year. 


In 1988 work began to implement the government’s 
commitment, as expressed in The Steps Ahead, to 
convert the publications into a computerized format 
in order to increase their usefulness in providing 
access to government information sources. The 
conversion is proceeding on a parallel course with 
implementation of the Management of Government 
Information Holdings Policy. 


Total ATIP Costs The cost reported by depart- 
ments for administering the Access to Information 
Act in 1987-88 was $3,985,867. During this period 
$63,387 was recovered in fees. Review of ATIP op- 
erations has indicated that considerable time in- 
volved with processing Access requests, outside Co- 
ordinators’ offices, particularly time spent in review- 
ing documents, is not accounted for in departmental 
reporting. Actual costs of administering the Act for 
this period, which take into account these unre- 
ported activities, are estimated at more than 
$9,000,000. The reported cost of administering the 
Privacy Act for this period was $3,921,096 (no fees 
are charged). 


As the government renews its efforts to achieve a 
more equitable sharing of the costs of administra- 
tion generally, it wants to re-examine the policy 
whereby information, often assembled at high cost 
to the taxpayer but provided to requesters under the 
Access to Information Act at minimal fees, is then 
used for commercial purposes with profit potential. 


Charts and Tables 


Disposition of Access to Information Requests 


by Fiscal Year 1983/84 to 1987/88 (Per cent in brackets) 


1983/84 1984/85 1985/86 1986/87 1987/88 Total 
Requests received 1,513 2,229 3,607 5,450 7,301 20,100 
Requests completed 1,286 2,119 3,950 4,991 5,866 17,812 
(100.0) (100.0) (100.0) (100.0) (100.0) (100.0) 
Disposition 
all disclosed 496 899 1,314 1,638 1,698 6,045 
(38.6) (42.4) (37.0) (32.8) (28.9) (33.9) 
some disclosed 252 531 1,036 1,803 2,012 5,634 
(19.6) (25.1) (29.2) (36.1) (34.3) (31.6) 
treated informally na na 161 203 844 1,258 
(4.5) (5.1) (14.4) (7.1) 
no record disclosed 
exempted 95 154 204 225 205 903 
(7.4) (7,2) (5.7) (4.5) (3.8) (5.1) 
excluded ot 36 44 99 38 208 
(2.4) (1.6) (12) (1,2) (0.6) (1.2) 
did not exist 127 170 256 452 458 1,671 
(9.9) (8.0) (7.2) (9.1) (7.8) (9.4) 
could not be 
processed * 283 330 038 062 992 2,309 
(22.0) (15.6) (15.2) (11.3) (10.1) (12.9) 


* 


Reasons include lack of information and abandonment by the applicant. 


Source of Access to Information Requests, 


1987/88 


a Business 48.2 % 


Individuals 27.2 % 


Media 9.3 % 


Organizations 7.6 % 
Not Known 4.6 % 
Academics 3.1 % 


Ten Institutions With Most Access to Information Requests 
for Fiscal Year 1987/88 Compared to Rank in 1986/87 


Requests Per cent Cumulative Rank 

received total per cent in 1986/87 
1 Supply and Services 1,760 24.1 24.1 1 
2 Revenue Canada Taxation Lol 20.1 44.8 8 
3 National Archives 466 6.4 512 3 
4 National Defence 309 4.2 99.4 4 
5 Justice 292 4.0 59.4 6 
6 Employment and Immigration 211 of 63.1 10 
7 External Affairs 207 2.8 66.0 2 
8 Royal Canadian Mounted Police 170 2.3 68.3 9 
9 Revenue Canada Customs and Excise 127 1? 70.0 17 
10 Canadian International Development Agency 114 1.6 71.6 is 


Time Required to Complete Access to Information Requests, 


1983/84 to 1987/88 


Days 


61+ 


31-60 


0 10 20 30 40 50 60 70 80 
Per cent of requests completed 


1987/88 
1986/87 
1985/86 


1984/85 


1983/84 


Access to Information Act Exemptions Used Most Frequently 
(Top Six) 1985/86 to 1987/88 (Most Recent Three Years) 


1987/88 


1986/87 


1985/86 


Per cent of total exemptions 


Exemptions Sections of the ATI Act 


13 - Information obtained in confidence 
15 - International affairs and defense 

16 - Law enforcement and investigations 
21 - Operations of Government 

19 - Personal information 

20 - Third-party information 


Costs and Fees for Access to Information Operations 


by Fiscal Year 1983/84 to 1987/88 


Requests completed 


Total cost 
of operations* 


Cost per request 
completed 


Total fees collected 


Fees collected per 
request completed 
Total fees waived 


Fees waived per 
request completed 


1983/84 


1,286 


$2,551,291 


$1,984 


$15,244 


$11.85 


$11,352 


$8.83 


1984/85 


2,119 


$3,613,275 


$1,705 


$27,606 


$13.03 


$7,802 


$3.68 


1985/86 1986/87 1987/88 Total 

3,550 4,991 5,866 17,812 

$4,197,399 $4,005,145 $3,985,867 $18,352,977 

$1,182 $802 S679 $1,030 

$39,951 $58,666 $63,387 $204,854 
$11.25 $11.75 $10.81 $11.50 

$14,520 $21,505 $32 373 $87,552 
$4.09 $4.31 $5.52 $4.92 


Generally, direct costs only. Considerable time spent outside Co-ordinators’ offices, particularly in reviewing 


documents, is not reported by institutions. 


Disposition of Privacy Requests 


by Fiscal Year 1983/84 to 1987/88 (Per cent in brackets) 


1983/84 


Requests received 
Requests completed 
Disposition 
all disclosed 
some disclosed 


no records disclosed 


exempted 


excluded 


did not exist 


could not be processed* 


17,109 


15,591 
(100.0) 


8,377 
(61.8) 

2,388 
(17.6) 


512 
(3.8) 

1 
(0.0) 

847 
(6.3) 

1,430 
(10.6) 


1984/85 


27,547 


24,951 
(100.0) 


14,768 
(59.2) 

5,898 
(23.6) 


710 
(2.8) 

2 
(0.0) 

1,360 
(5.5) 

2,218 
(8.9) 


1985/86 


38,606 


39,585 
(100.0) 


27,249 
(68.8) 

7,298 
(18.4) 


495 
(1.2) 

0 
(0.0) 

1,821 
(4.6) 

2,122 
(6.9) 


Reasons include lack of information and abandonment by the applicant. 


1986/87 


42,292 


44,621 
(100.0) 


28,571 
(64.0) 

10,551 
(23.6) 


1987/88 


49,626 


47,963 
(100.0) 


31,202 
(65.1) 

10,760 
(22.4) 


206 
(0.4) 

6 
(0.0) 

2,922 
(5.3) 

3,306 
(6.9) 


Total 


175,180 


170,671 
(100.0) 


110,167 
(64.5) 

36,895 
(21.6) 


2,116 
(1.2) 

16 
(0.0) 

8,393 
(4.9) 

13,126 
Wee 


Time Required to Complete Privacy 


Requests, 1983/84 to 1987/88 


Days 


1987/88 
1986/87 


1985/86 
1984/85 
M 1983/84 


fea iat TIC) ttt [I (a amet Pea Ct Cn ie Fm a a So © me ie) ESS Da 
0 10 20 30 40 50 60 70 


Per cent of requests completed 


Privacy Act Exemptions Used Most Frequently 


(Top Four) 1985/86 to 1987/88 (Most Recent Three Years) 


549 | 


1987/88 


1986/87 


50.5 |» 


1985/86 


30 40 50 60 


Per cent of total exemptions 


Exemption Sections of the Privacy Act 


|_| 26 - Information about 19 - Personal information 


another individual obtained in confidence 
{| 22 - Law enforcement and MB 24 - Individuals sentenced for 
investigation an offence 


Five Institutions with Most Privacy Requests 


for Fiscal Year 1987/88 Compared to Rank in 1986/87 


Requests Per cent Cumulative Rank 

Received Total Per cent in 1986/87 
1 National Defence 23,819 48.0 48.0 1 
1) Correctional Service 8,672 Lick 65.5 2 
3 National Archives 8,198 16.5 82.0 3 
4 Royal Canadian Mounted Police Skee 6.3 88.3 4 
5 Employment and Immigration 2,571 5.2 93.5 5 


Costs of Privacy Operations 


by Fiscal Year 1983/84 to 1987/88 


1983/84 1984/85 1985/86 1986/87 1987/88 Total 
Requests completed 15,591 24,951 39,585 44,621 47,963 170,671 
Total cost pa Les as 
of operations* $3,795,421 $4,796,866 $4,741,068 $4,738,415 $3,921,096 $21,992,866 
Cost per request $280 $192 $120 $106 $82 $129 


* 


Generally, direct costs only. 


Appendix A 
Authorized uses of the 
Social Insurance Number 


Statutes and Regulations 

Canada Elections Act 

Canada Labour Standards Regulations 
(Canada Labour Code) 

Canada Pension Plan Regulations 
(Canada Pension Plan) 

Canada Student Loans Regulations 
(Canada Student Loans Act) 

Canadian Wheat Board Act 

Family Allowances Regulations 
(Family Allowances Act, 1973) 

Family Orders and Agreements Enforcement 
Assistance Act and Regulations 

Gasoline and Aviation Gasoline Excise Tax 
Application Regulations 
(Excise Tax Act) 

Income Tax Act 

Labour Adjustment Benefits Act 

Old Age Security Regulations 
(Old Age Security Act) 

Race Track Supervision Regulations 
(Criminal Code) 

Tax Rebate Discounting Regulations 
(Tax Rebate Discounting Act) 

Unemployment Insurance Act, 1971 and 
Regulations 

Veterans Allowance Regulations 
(War Veterans Allowance Act) 


Programs authorized to use the SIN 
Income and Health Care Programs 
(Veterans Affairs) 
Immigration Adjustment Assistance Program 
(Employment and Immigration) 
Labour Adjustment Review Board 
(Labour) 
National Dose Registry for Occupational Exposures 
to Radiation 
(National Health and Welfare) 
Rural and Native Housing Program 
(Canada Mortgage and Housing Corporation) 
Social Assistance and Economic Development 
Program 
(Indian Affairs and Northern Development) 
Tax Case Appeals 
(National Revenue - Taxation) 


Y, 
Yi, 


Appendix B 
Employee Privacy Code 


The Federal Government as an employer is commit- 
ted to fair information practices for its employees, 
which creates a legitimate and enforceable expecta- 
tion of privacy. These are expressed for all govern- 
ment institutions in the Privacy Act (1983), which 
has as its broad purpose “to ... protect the privacy of 
individuals with respect to personal information 
about themselves held by a government institution 
and ... provide individuals with a right of access to 
such information.” (Privacy Act, section 2). 


Personally identifiable information exists in em- 
ployee and job applicant records. The collection, 
use, disclosure, retention and disposal of this infor- 
mation must be managed in a way that takes into 
account the Privacy Act’s principles of confidential- 
ity, accuracy and relevance. The spirit and the letter 
of the Privacy Act, as it pertains to Federal employ- 
ees, is expressed in the Employee Privacy Code. 


The Code consists of six Principles, as follows: 


e Anaccess process must be in place to enable an 
employee to find out what information about him 
or her is in a record and how that information ts 
used. 


All personal information holdings must be de- 
scribed as personal information banks by the 

government institutions controlling them and 
published in the annual Personal Information 

Index. 


Employees must, with some exceptions, be 
given access to the information pertaining to 
them. This should normally be done informally 
without recourse to the formal procedures of 
the Privacy Act. However, no prejudicial actions 
will be taken against an employee who wishes to 
exercise his or her legal rights. Personal infor- 
mation will be withheld from access by employ- 
ees only in strict compliance with the limited 
situations for exemption set out in the Privacy 
Act. 


There must be no classes of information and no 
personal information banks whose existence 1s 
not known. 


A process must be in place to enable an employee 
to correct a record containing personal informa- 
tion about him or her. 


Employees are entitled to ask that information 
pertaining to them be corrected, and they have 
the right to have a notation attached to any in- 
formation for which a correction was requested 
but not made. 


The legal provisions limiting the collection of per- 
sonal information must be followed. 


The collection of personal information must be 
directly relevant to an authorized program or 
activity. Whenever possible, personal informa- 
tion shall be collected directly from the individ- 
ual to whom it pertains. There are limited ex- 
ceptions to this general rule, for example, law 
enforcement activities. An employee must also 
be informed why the information is being col- 
lected and the intended uses to be made of it, 
except when doing so would result in the collec- 
tion of inaccurate or misleading information. 
Employees must also be told whether the infor- 
mation is required by law, and, if not, that giving 
it is purely voluntary. 


Controls that conform to legal requirements must 
be in place to regulate the use and disclosure of 
employee information. Uses beyond the original 
purposes for which information was collected and 
disclosures to third parties, in particular, are cir- 
cumscribed. 


Without the consent of the employee to whom it 
relates, personal information shall only be used 
for a purpose for which it was collected, or for a 
purpose consistent with the original purpose, or 
for a purpose permitted under the disclosure 
part of the Privacy Act, subsection 8(2). 


Personal information shall not, without the con- 
sent of the employee, be disclosed to third par- 
ties except in the limited number of situations 
set out in subsection 8(2) of the Privacy Act. 
Some of these situations include the require- 


ments of other Acts and Regulations, compliance 
with a subpoena or warrant, internal audits, and 
archival purposes. In many instances these 
provisions are permissive and the onus is on 
personnel administrators to determine that a 
particular instance of permissible disclosure of 
personal information is fair to the employee 
concerned. 


Certain very sensitive personal information, 
such as Employee Assistance Program (EAP) 
data, medical files and conflict of interest decla- 
rations, should be disclosed to persons other 
than the official responsible (e.g. EAP Counsel- 
lor) only when compelled to do so by law or 
regulation that requires its disclosure. 


Uses of personal information that are not listed 
in the personal bank descriptions in the Personal 
Information Index shall be recorded, and the 
record attached to the personal information. 
The Privacy Commissioner must be advised, 
and the new use must subsequently be pub- 
lished in the Personal Information Index. 


Data matching and linkage involve comparing 
for administrative purposes personal informa- 
tion obtained from various sources. They are 
used widely in personnel administration, and 
generally involve the use of computers to gener- 
ate more extensive profiles of individuals. Data 
matching is regulated by Treasury Board policy 
to ensure compliance with the Privacy Act, par- 
ticularly as it relates to the Ac?’s provisions deal- 
ing with the collection, use and disclosure of the 
personal information to be matched. Govern- 
ment institutions are required to give 60 days’ 
advance notice of matching programs to the 
Privacy Commissioner and to describe them in 
the Personal Information Index. 


Government institutions should ensure that per- 
sonal information 1s accurate and that appropri- 
ate precautions are taken to protect tt. 


Personal information has a life cycle; that is, it 
exists from the time it is originally collected or 
compiled to the date it is finally disposed of. 
Throughout its life cycle, personal information 
should be current and accurate for its intended 
use. Adequate safeguards and protection 
should be provided to prevent its misuse. 


The government Security Policy specifies that 
personal information be given enhanced protec- 
tion. It is designated PROTECTED - PER- 
SONAL INFORMATION, and the government- 
wide security standards set out appropriate 
protection. This includes lockable storage con- 
tainers, controlled access to the areas in which 
personal information is located, and security 
measures related to transmitting it. 


Additional protection is provided for particularly 
sensitive personal information in EAP and medi- 
cal files. For example, information that can be 
linked to a client in an EAP file is accessible 
only to the client and the EAP Coordinator. 
Particularly sensitive personal information is 
designated PROTECTED, followed by words 
that describe the category of information (e.g. 
PROTECTED - Employee Assistance Program), 
and particular storage and transmittal standards 
support the additional protection. 


Employees shall be able to find out how their per- 
sonal information will be finally disposed of. 


Personal information must be retained and dis- 
posed of in accordance with approved and pub- 
lished records retention and disposal schedules. 
Except as otherwise provided in law, or when 
the employee consents to earlier disposal, per- 
sonal information must be kept for a minimum 
of two years after the last time it was used for an 
administrative purpose, so that employees have 
an opportunity to request access to the informa- 
tion and ask for a correction if necessary. 


Management of The Code 


Organization 

The head of the personnel function should be re- 
sponsible for the management of employee privacy 
matters, because employee personal information 
and employee records are usually under his or her 
jurisdiction. 


Treasury Board policy provides for the designation 
of an Access to Information and Privacy (ATIP) 
Coordinator in each department or agency. This 
official has detailed knowledge of the Privacy Act 
and its Regulations; Part III of the Interim Policy 
Guide, which governs the application and interpreta- 
tion of the Act and Regulations; and other guidance 
from the Treasury Board Secretariat. The ATIP 
Coordinator should play an active role in advising 
the head of the personnel function when institu- 
tional practices to protect personal information are 
being established. 


Published Personal Information Banks 

The Privacy Act requires the government to produce 
the Personal Information Index. As a matter of pol- 
icy, each government institution must include, in its 
descriptions of its Personal Information Banks, de- 
tails of all the consistent uses for which information 
in any bank can be used or disclosed. 


The Personal Information Index is organized into 
chapters, one for each federal institution and any 
related agencies. Of particular relevance are the 
listings of Personal Information Banks - Federal 
Employees. These are sub-divided as follows: 


¢ Standard Banks 
Banks containing the standard information that 
all federal departments maintain on their em- 
ployees. Standards Banks outline the uses, dis- 
closures, and retention and disposal criteria that 
normally apply to employee information held by 
federal departments. If the Standard Banks are 
used to describe employee information, these 
conditions must be applied. Any Personal Infor- 
mation Bank containing employee records that 
differs from a relevant Standard Bank descrip- 
tion must be described under Particular Banks, 


with the conditions relating to use, disclosure, 
retention and disposal of the information de- 
scribed in detail. 


¢ Central Banks 
Banks maintained by central agencies and some 
departments, such as Treasury Board, the Pub- 
lic Service Commission and the Department of 
Health and Welfare, and containing information 
about employees across the Public Service. 


e Particular Banks 
These banks contain information on employees 


over and above that maintained in Standard 
Banks. 


The Personal Information Index is available in public 
libraries in major population centres and in ATIP 
reading rooms or other locations established within 
government institutions. 


Audit 

The Privacy Act provides for government institu- 
tions’ accountability to Parliament. It also author- 
izes the Privacy Commissioner to carry out investi- 
gations from time to time to determine whether 
personal information held by government institu- 
tions is handled in accordance with the Privacy Act. 
Special procedures are in force for auditing Em- 
ployee Assistance Program files, which recognize 
the extra sensitivity of these files. 


Redress 

An employee may complain to the Privacy Commis- 
sioner when he or she has not obtained satisfaction 
on any of a broad range of matters covered by the 
Privacy Act. Appeal to the Federal Court is available 
when access to personal information has been 
denied. 
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